Ron Eddings

Huge SBOM Update! We've revamped the SBOM Labs in the latest revision for the SANS SEC547 Defending Product Supply Chains course, and will be releasing this new content at SANSFIRE in July! In this update we've added over 20 new tools to the course virtual machine, a purpose-built Linux OS designed for supply chain security work. And many of these tools feature in 3 completely new labs that will show you how to: ✅ Generate SBOM from open source, binaries, firmware and containers ✅ How to request SBOM from suppliers and validate what they provided ✅ Analyzing SBOMs for vulnerabilities and other risks and managing them at scale ✅ Working with multiple vulnerability databases ✅ Verifying SBOM quality and enriching content such as software provenance and pedigree ✅ Comparing tool output to evaluate your SBOM tool providers ✅ Supply Chain Incident Response ✅ And much more! This is a full lifecycle process that can take you from just getting started, to achieving meaningful value from your SBOM initiative. We cover a lot more than just SBOM across vendor risk, geopolitical and supply chain threats, hardware and HBOM, and supply chain attestations, so check out the course and register below. I can't wait to have you in class this July! https://lnkd.in/eNYNBY7R #sbom #cybersecurity #supplychainsecurity #scrm #softwaretransparency

39

2 Comments

As you've probably heard by now, Verizon's 2024 Data Breach Investigations Report (DBIR) just dropped. I'm proud to say that Cyentia Institute was a contributor again this year. I should say "one of the many, many data contributors." I know most people focus on the findings from the DBIR - and they should. But to me, this is the most remarkable and important aspect of the DBIR. I can't think of any other report/project in the #cybersecurity field that can unite all these logos in a common effort of data sharing and analysis. And do it for 15 years! Yes - I know the DBIR first published more than 15 years ago (I was there). But 2010 was the first time we included non-Verizon data from the U.S. Secret Service. That initial step took quite a bit of effort, but then they introduced us to the Dutch High Tech Crime Unit, the Australian Federal Police, London Metropolitan Police...and the dominos kept going. I clearly remember when I got a "yes" from the first private sector IR service provider that was a competitor of Verizon at the time. The execs HATED the idea of sharing the spotlight, but they eventually conceded. And their participation paved the way for all the others you see here. And though I'm no longer leading the DBIR production effort, I'm honored to be one of those logos I started adding so long ago. Also - it's not easy managing all those contributors and datasets. As you review and apply all the insights from this year's DBIR, raise a toast of appreciation to the DBIR team that is dedicated to what they do for the community. Many thanks David Hylender Suzanne Widup Philippe Langlois Alex Pinto #databreaches #cyberrisk

259

15 Comments

The ROI on preventative and proactive cyber security controls increases each day and with each reported breach. Let's hope for Panasonics sake that this one is just chatter and not their reality! Either way it highlights the requirement for increased security defences - DM me if you'd like to know more about exactly what your organisation can do to stay ahead and be prepared in case of the worst case.

2

[genAI] good article on the power of agents and the kind of workflows that I'm adding to The Cyber Boardroom nice picture from the linked report about the current landscape of companies providing (or working on) agents https://lnkd.in/eTDF_6iQ

14

3 Comments

🛸 A common cyber attack attempt right here. Whenever you receive an e-mail, text, pop up or voicemail regarding contacting ANYBODY to resolve something, google that phone number first. 99/100 times this number will have been previously reported as a scam number. Google 8889915696 and you will see nothing but debt collector scams turn up as results. 🌝 I was instantly suspicious because I've never had Verizon account but the chance that whoever they are texting has had Verizon is fairly high. Phishing is a numbers game. 💻 Working as a Service Desk Analyst, there were an abundance of these scams in the form of pop ups that would hide the users mouse and claim that Microsoft Defender detected a trojan or malicious software and that the user should contact Microsoft at a number provided. It was also very bulky data wise and did slow down their computers as well until the web browser was close via the task manager. I always taught the employees to search numbers first and only ever call their employers service desk so we can handle any credential or security issues. 🔑 Cyber Security is for everybody, the knowledge you learn at work can make the difference between getting scammed or not in your personal life. Statistically, the vast majority of scam victims are over the age of 65, a population that many did not work with computers for the majority of their life and are unaware of social engineering tactics that target users emotions (usually fear) in order to manipulate their behavior.

5

1 Comment

Known Exploited Vulnerabilities Remain Unmitigated Past Deadlines: - Critical severity KEVS took nearly 4.5 months (137 median days) - High severity vulnerabilities take more than 9 months (238 median days) - Medium severity vulnerabilities take nearly 1.5 years (517 median days) https://lnkd.in/g_RExD96

1

According to Verizon's 2024 Data Breach Investigations Report, the exploitation of vulnerabilities as an initial access point for breaches increased by 180% between 2022 and 2023. This surge is driven by zero-day exploits and other vulnerabilities exploited by ransomware actors. The report underscores the need for quick patching, enhanced security awareness, and advanced threat detection. Is your organization prepared for these threats? Remember, CMIT Solutions is your IT resource. #Cybersecurity #DataBreach #Vulnerabilities https://lnkd.in/eJx3KvxE

9

I am honored to be quoted extensively in Ray Fernandez's latest article on Moonlock, which explores #GRU's elite hacking unit #BlueDelta and its recent #cyberespionage campaign ranging from the attacks on European railways to efforts to infiltrate #import-#export #logistics for #Ukraine's arms and humanitarian supply transfers along the newest #corridor circumventing #Russia's blockade of the #BlackSea. I provide #geopolitics context for #BlueDelta involvement, addressing #Kremlin's aim to reshape global #supplychains and #logistics through #economicwarfare. I talk about the coordination between the #European railway attacks as #Russia's seeks to capitalize on #Houthi disruption of the #IMEC (Spice Route/#MiddleEastCorridor) with EU and #India to benefit the #North-#SouthCorridor forcing #India to transfer its products by Russian railways overland instead, and why #GRU has an interest in gathering intel on #Ukraine's #supplychains in general, including its #grain supply to the #MiddleEast and #Africa, and #sabotage of its #assistance from #NATO specifically. #cybersecurity #hackers #infosec #informationsecurity #technology #bigtech #RussiaUkraine #RussiaUkraineWar #RussiaUkraineConflict #RussiaUkraineCrisis #RussiaInvadedUkraine #RussianInvasion #RussianAggression #military #security #defense #maritimesecurity #humanitariancrisis #humanitarianaid #humanitarianassistance #intelligence #counterintelligence #espionage #economy #northafrica #Israel #Egypt #Procurement #foreignpolicy #foreignaffairs #diplomacy #geopolitics #trade #Europe #EuropeanUnion #Houthis #RedSeaSecurity #arabworld #Iran #terrorism #counterterrorism #extremism #counterextremism #Gaza #Hamas

2

Expanding APT42 Threat Intelligence with Validin - an example of using high-confidence threat intelligence to find and track dozens of additional related indicators using PDNS history. https://lnkd.in/eGanB2mG

33

You probably heard about BeyondTrust acquiring Entitle for ~$150 million. Here's the part you may not have heard: Co-founder Ron Nissim called his shot about IGA converging with PAM just over a year ago. I had the opportunity to interview Ron last year right before Entitle came out of stealth. One of the topics we talked about was the convergence of IGA and PAM use cases. At the time, he had a theory: "I have a theory that IGA and PAM are converging in the cloud. What's essentially been happening to us is that we've been solving a lot of [PAM] use cases. We can provide a lot of the things that customers need from PAM, like just-in-time, temporary access management." He may not have fully realized it then, but his theory was totally right. This early insight ended up being one of the main strategic drivers for BeyondTrust's acquisition of Entitle. Congratulations to the Entitle team! ___ Thanks again to Elizabeth Safran and Dean Pe’er for making this interview happen. The full discussion from February 2023 is available on my website if you want to revisit Entitle's journey from launch to acquisition.

109

17 Comments

How to lessen the impact of complying with DFARS CUI requirements (DFARS 252.204.7012) or the CMMC program assessment you may be required to meet. Yes, the costs will be high esp. for an SMB. The answer is a business answer and not a cybersecurity answer at all. When I study P&L statements and balance sheets with my financial review team (these days that means by myself :p), I see large expenses that are spread out across months and quarters. This is how to avoid that large lump payment that hurts. The same for the DFARS and CMMC preparations. Spread out your workload across 12-18 months. Pay for services as you need them in small affordable amounts. For example, make a $30k CMMC preparation a $1600/Month expense over 18 months. There is another secret benefit to this approach - most compliance experts will tell you that it takes that long anyway if you are to truly implement a proper and passable cybersecurity program. So many of the answers to managing a cybersecurity program can be found in the daily business practices you already are doing. I have been studying how to lessen the burden on SMB's to achieve compliance and have some controversial ideas that I have been slowly unwinding here. They include: 1. [Executive Leadership] CEO emotional intelligence (EQ) - no this is not an attack but a concept for executive leadership if you have read anything about it [Subtopic Executive Coaching] 2. [Team Building] Team Transparency and commitment. 3. [Project Management] Use of tools like OKR's to keep the 18-month program on track and accountable to each other (another sign of EQ). Trust is good but verification is better. 4. [IT Planning and Management] Putting together the right mix of tools (yes you might choose to buy some software for parts of this) that will help you cover a majority of the security controls and requirements without overlap. 5. [Board Room Discussion] Consideration of your IT architecture and migrations to platforms that will ease the compliance burden. 6. [HR} Find a compliance SME that your team can work with over the 18 months and beyond. Get the right consultant on the bus and get the wrong consultant off the bus. Food for thought. #CW #ceomindset #CMMC #cybersecurity #DFARS

2

1 Comment

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

100

9 Comments

https://lnkd.in/ghNU25zv This summary from NIST is a great place to start in understanding some of the new changes to 2.0. Please note the addition of "Govern" to the classic list of outcomes. Govern: The organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored Identify: The organization’s current cybersecurity risks are understood Protect: Safeguards to manage the organization’s cybersecurity risks are used. Detect: Possible cybersecurity attacks and compromises are found and analyzed. Respond: Actions regarding a detected cybersecurity incident are taken Recover: Assets and operations affected by a cybersecurity incident are restored. Cytellix®National Institute of Standards and Technology (NIST) Daniel Eliot

10

Organization’s struggle with documenting NIST SP 800-171’s 3.3.1 System Auditing, especially when they are using Commercial Off the Shelf (COTS) software or cloud services. Like all of the other As the CMMC Churns Understand the Requirements series, we will walk you through understand the key definitions, the Assessment Objectives, and demonstrate how we show conformity to 3.3.1 System Auditing using SharePoint lists and Azure Sentinel. This Understand the Requirements video will be critical when we get to 3.3.3, Review and Update Logged Events, a THOROUGHLY misunderstood requirement. =============================================== Peak InfoSec Homepage: https://peakinfosec.com As the CMMC Churns Episodes: https://lnkd.in/eVGYGs3g Contact Peak InfoSec for Support: https://lnkd.in/e8sM_2Z3 Email: cmmc@peakinfosec.us =============================================== #cuicon #cmmc #cmmc2 #32cfrpart2002 #32cfrpart170 #infosec #informationsecurity #compliance #cybersecurity #cui #fci #cmmcab #thecyberab #nist800171 #defenseindustry #defensecontractors #defensecontracting #grc #manufacturing #dfars #manufacturingindustry #dib #satellite #satellitecommunications #satellitesystems #managedserviceprovider #msp #managedsecurityservices #mssp #DoD #GovCon #governmentcontracting #SmallBusiness #contracts #contractors https://lnkd.in/entjZARv

11

QR Codes are more popular than ever. Do you know where your phone will take you if you tap a QR Code? In “Watch Out for QR Codes in Phishing Emails,” Mark Anthony Germanos explains, in layman’s terms, how QR Codes work and more importantly, how to vet links. Think twice before tapping a QR Code on your phone. This short video can save you from becoming an identity theft victim. #cybersecurity #QRCodes #Germanos #staysafeonline

1

QR Codes are more popular than ever. Do you know where your phone will take you if you tap a QR Code? In “Watch Out for QR Codes in Phishing Emails,” Mark Anthony Germanos explains, in layman’s terms, how QR Codes work and more importantly, how to vet links. Think twice before tapping a QR Code on your phone. This short video can save you from becoming an identity theft victim. #cybersecurity #QRCodes #Germanos #staysafeonline